{"id":"CVE-2026-59006","kind":"vulnerability","aliases":["CVE-2026-59006"],"related":[],"title":"Android: window touch occlusion check lets overlay apps tapjack users","description":"In getTouchOcclusionMode of WindowState.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.","summary":"A flaw in Android's WindowState.java touch occlusion logic lets a malicious overlay trick a user into tapping something they cannot see. An attacker can use this to disclose local information, with no extra execution privileges needed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","runtime"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T20:17:55+00:00","first_seen_at":"2026-11-02T20:35:36+00:00","triaged_at":"2026-11-02T20:37:01+00:00","updated_at":"2026-11-02T20:37:01+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-02T20:37:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android: window touch occlusion check lets overlay apps tapjack users","impact":"low","summary":"A flaw in Android's WindowState.java touch occlusion logic lets a malicious overlay trick a user into tapping something they cannot see. An attacker can use this to disclose local information, with no extra execution privileges needed.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["android"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"local information disclosure through tricked taps","analyst_note":"Find the affected Android versions and the Android Security Bulletin entry for CVE-2026-59006 to confirm the fixed patch level.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources do not name affected Android versions or builds, and do not say which apps or settings are involved. Only Android devices are implied by the Android framework file named in the description.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000609,"input_tokens":4109,"output_tokens":396,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-59006':13A,16A 'addit':80C 'android':1A,17B,22B 'app':8A 'attack':42B,70C 'cannot':39B 'check':5A 'could':72C 'cve':11A,14A 'disclos':47B 'disclosur':77C 'due':66C 'execut':53B,81C 'exploit':89C 'extra':52B 'flaw':20B 'gettouchocclusionmod':57C 'inform':49B,76C 'interact':85C 'issu':65C 'lead':73C 'let':6A,28B 'local':48B,75C 'logic':27B 'malici':30B 'need':55B,83C,87C 'occlus':4A,26B 'overlay':7A,31B 'possibl':63C 'privileg':54B,82C 'runtim':18B 'see':40B 'someth':37B 'tap':36B 'tapjack':9A,64C 'tapjacking/overlay':69C 'touch':3A,25B 'trick':32B 'use':44B 'user':10A,34B,84C 'window':2A 'windowstate.java':24B,59C","nicknames":[],"mitigations":[],"who_affected":"The sources do not name affected Android versions or builds, and do not say which apps or settings are involved. Only Android devices are implied by the Android framework file named in the description.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","runtime","unknown"],"first_public_at":"2026-11-02T20:17:55+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59006","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59006","severity":null,"published_at":"2026-11-02T20:17:55+00:00","modified_at":"2026-11-02T20:17:55+00:00","first_seen_at":"2026-11-02T20:35:36+00:00","fetched_at":"2026-11-02T20:35:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}